Chapter 21 — Network and communications security: system models

Chapter 21 — Network and communications security: system models

Lesson map

Lesson 21 published. Map, example, EX061.

flowchart TD
  N0["Learning outcomes"]
  N1["21.1 A model of the clinics"]
  N2["21.2 Flows as the core of the model"]
  N3["21.3 Dependencies"]
  N4["21.4 Reasoning about change"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX061"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["21.1 A model of the clinics"]
  N2["21.2 Flows as the core of the model"]
  N3["21.3 Dependencies"]
  N4["21.4 Reasoning about change"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX061"]

[Learning outcomes]
    |
    v
[21.1 A model of the clinics]
    |
    v
[21.2 Flows as the core of the model]
    |
    v
[21.3 Dependencies]
    |
    v
[21.4 Reasoning about change]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX061]

Learning outcomes

You will (1) model the clinic network as a system; (2) identify flows and dependencies; (3) use the model to reason about change.

21.1 A model of the clinics

Priya builds a model of the clinic network that is simpler than reality but captures what matters for security: four clinics, each with staff, clinical, guest and management groups; a shared booking service hosted by a provider on the internet; a lab results server at the main clinic; and links between clinics over the internet. The model leaves out cable routes and device brands, which do not affect who can reach what. A good model is small enough to reason about in full and detailed enough to answer the questions it was built for.

21.2 Flows as the core of the model

The heart of the model is the list of flows: which group starts a connection to which destination, on which service and why. Priya identifies eight needed flows, such as staff to the booking service over HTTPS and clinical carts to the lab results server. Everything else in the model follows from these flows: the firewall rules, the subnets that rules refer to and the logging that records them. If the flows are wrong or incomplete, every later step inherits the error, so she reviews the list with the clinic IT lead and two clinic managers before going further.

21.3 Dependencies

Flows depend on supporting services. Staff reaching the booking service by name need DNS; devices obtaining addresses need DHCP; accurate log times need time synchronisation. These supporting flows are easy to forget because nobody thinks of them as applications, yet blocking them breaks everything. Priya adds them to the model explicitly, with notes on which zone provides each service. Forgetting dependencies is one of the most common reasons segmentation projects cause outages on the day they go live. Each supporting service is given an owner and a test.

21.4 Reasoning about change

With the model, Priya can ask what happens if something changes before changing it. If the lab results server moves to a cloud provider, which flows change and which rules must follow? If a new clinic opens, which values are new and which stay the same? Answering these on paper is quick and cheap. The model also exposes surprises, such as discovering that the guest network depends on the same DNS server as clinical devices, which would let a busy guest network slow clinical name lookups.

Worked example

Priya's model lists eight needed flows plus three supporting services, and reveals a shared DNS dependency between guest and clinical groups.

Synthetic case. The model is synthetic.

Errors and limits

Models that omit supporting services such as DNS and time lead to outages when rules are enforced.

Exercises

• EX061 — Model detail choice. Why does the model omit cable routes and device brands? Rubric: 3 = they do not affect reachability questions;; 2 = irrelevant;; 1 = simplify;; 0 = none.
• EX062 — Forgotten dependency. Name a supporting service commonly forgotten in segmentation. Rubric: 3 = DNS, DHCP or time;; 2 = DNS;; 1 = vague;; 0 = none.
• EX063 — Shared DNS risk. Why is a DNS server shared by guest and clinical groups a concern? Rubric: 3 = guest load or misuse could affect clinical lookups;; 2 = shared;; 1 = vague;; 0 = none.

Synthesis

A flow-centred model lets designers reason about security and change before touching the network.

Continue studying — chapter 21 of 40

← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →